Centralized versus decentralized exchanges

To exchange Brazilian reais for bitcoin, or one crypto asset for another, you need a place where buyers and sellers meet. That place is called an exchange. There are two very different models: the centralized exchange, operated by a company, and the decentralized one, operated by smart contracts on a blockchain.

This article compares the two models on what matters most to you: who keeps your assets, how the price is formed, what risks exist and what Brazilian regulation covers. The rules cited were checked on October 8, 2026. The article does not recommend any platform.

Centralized exchange: the company in the middle

On a centralized exchange (CEX), you open an account, register and deposit reais or crypto assets. From then on, the company holds the assets and records your balance in an internal system. When you buy, it matches your order with another client’s in an order book.

This has practical consequences:

• Custody. The private keys, which give control over the crypto assets, stay with the company. The pros and cons of this arrangement are covered in Crypto wallets: custodial and non-custodial.
• Fiat on- and off-ramp. It is through the exchange that most people convert official currency into crypto assets and vice versa.
• Support and account recovery. Forgetting your password is a solvable problem, because there is an identified company on the other side.

Many functions in a single company

The point of concern highlighted by regulators is the concentration of roles. The Financial Stability Board (FSB) studied so-called multifunction intermediaries: companies or groups that combine a trading platform, proprietary trading and, in some cases, the issuance and distribution of crypto assets, including stablecoins (FSB, 2023).

According to the FSB, weak controls, little transparency and conflicts of interest amplify vulnerabilities such as leverage and liquidity mismatch. The report cites the collapse of FTX, in November 2022, as an example of the critical role these companies play in the sector.

IOSCO, which brings together capital market regulators, published eighteen recommendations for the sector in November 2023. The first area addressed is precisely the conflicts of interest arising from the vertical integration of activities; others cover market manipulation, custody and protection of client assets, and operational risks (IOSCO, 2023). In plain language: when the same company runs the market, trades on its own account and holds your money, you need to know how it separates these functions.

Decentralized exchange: the contract in the middle

On a decentralized exchange (DEX), you do not deposit anything with a company. You connect your own wallet and trade with smart contracts. The concept is detailed in DeFi: what decentralized finance is.

IOSCO describes two types of DEX (IOSCO, 2023):

• With an order book. Someone maintains a website or app and an order book off the blockchain, which is used only to settle trades. Unlike a centralized platform, whoever runs the DEX may never have control over users’ assets.
• With an automated market maker (AMM). A contract holds reserves of two tokens, deposited by liquidity providers, and calculates the price by formula from the ratio between them.

On Uniswap, an example of an AMM, traders interact directly with the pool, not with another person’s order. The larger the trade relative to the pool’s size, the more it moves the price (Uniswap, documentation). This effect is price impact, and it weighs more in small pools.

The risk of the transaction queue

On a DEX, your order becomes a public transaction before it is confirmed. This opens room for what ethereum.org calls MEV (maximal extractable value): the profit that block builders, or bots that watch pending transactions, obtain by including, excluding or reordering transactions (ethereum.org).

The best-known example is the “sandwich”: a bot sees a large pending purchase, buys before it and sells right after, taking advantage of the price rise your own trade causes. According to the same page, whoever is sandwiched executes the swap at a worse price.

No company, no support

The absence of an intermediary also means the absence of anyone to answer. If you sign a wrong transaction, send to the wrong address or interact with a malicious contract, there is generally no way to undo it. Wallet security becomes yours alone; see How to protect a wallet’s seed phrase and Phishing in digital wallets: how to protect yourself.

And “decentralized” does not mean “ownerless.” IOSCO notes that DEX code is created, operated and maintained by people, and that parameters can be changed by the project team or by a vote of token holders.

Side-by-side comparison

Aspect	Centralized exchange	Decentralized exchange
Who holds the assets	The company	You, in your wallet
How the price is formed	Internal order book	Order book or pool formula
Registration	Required	Generally not required by the protocol
Deposits in reais	Yes, on most	No, operates only with crypto assets
Typical risk	Bankruptcy, misappropriation or mismanagement by the company	Contract flaw, MEV, user error
Who to turn to	Identified company and supervisor	Generally, no one identifiable
Regulation in Brazil	Central Bank authorization	Not expressly addressed in the law

Neither column is “safe.” In both, the value of crypto assets can fall to zero, and scams that imitate both types of platform are common; see Crypto scams: how to spot and report them.

What the Brazilian rule covers

Law 14,478/2022 defines a virtual asset service provider as a legal entity that performs, on behalf of third parties, services such as exchange between crypto assets and currency, exchange between crypto assets, transfer and custody. These companies may only operate with prior authorization, and the Consumer Protection Code applies, where relevant, to transactions in this market (Law 14,478/2022).

Centralized exchanges fit this definition. BCB Resolution 520, in force since February 2, 2026, brings rules that directly affect the client (BCB Resolution 520):

• clients’ funds are kept separate from the company’s (Art. 28);
• clients’ crypto assets are kept in wallets distinct from those used by the company, with a policy that includes proof of reserves (Art. 30);
• the company may not use clients’ assets in its own operations, except in the cases provided for (Art. 31).

Transition deadlines for those already operating are in Crypto regulation in Brazil: who supervises what.

DEXs, on the other hand, are not expressly mentioned. Resolution 520 cites the decentralized finance segment only when requiring providers to strengthen cybersecurity in transactions with these operators (Art. 48, III). In the newsroom’s assessment, if you use a DEX directly, the guarantees above, designed for clients of authorized companies, generally do not apply. Internationally, IOSCO recommends that regulators identify the people responsible for DeFi arrangements and apply the rules based on the substance of the activity, regardless of the decentralization label.

Key takeaways

• On a centralized exchange, you trust a company; on a decentralized one, you trust the code, the people who can change it and your own security.
• Asset segregation and proof of reserves reduce the risk of the exchange using what is yours, but do not protect against price drops.
• Using a DEX means giving up registration and an intermediary, and also support, recourse and, generally, Brazilian regulatory protection.